HTB DanglingTree Complete Writeup: CVE-2026-23760 (SmarterMail Sysadmin Reset), CVE-2026-26119 (Windows Admin Center), DPAPI Credential Manager Dump and ESC1 Dangling Certificate Template Domain Admin
DanglingTree is a HackTheBox Season 11 Hard Windows machine built around one idea, the dangling reference. Enumeration of an anonymous SMB share leaks a low privilege domain credential that unlocks the Windows Admin Center gateway on port 6600, where an RSA OAEP encrypted login yields PowerShell code execution on the Domain Controller. From that foothold an unauthenticated SmarterMail sysadmin password reset (CVE-2026-23760, build 9504 before 9511) is fired at the loopback only mail service through a raw socket, and the resulting PrimarySysAdmin token is abused through the volume mount feature to execute commands as the svc_mail service account. A backup SmarterMail settings.json still holds an encrypted password for noah.b, which is recovered by extracting a hardcoded DES key and IV from SmarterMail.Standard.dll with offline dnfile parsing. Running as noah.b via RunasCs grants user.txt, and a saved cmdkey credential for alex.o is recovered by offline DPAPI decryption of the masterkey using the protected storage derivation. alex.o holds ForceChangePassword over jake.h, and jake.h holds CreateChild over the Certificate Templates and OID containers, which is enough to recreate one of three published but deleted certificate templates as a malicious ESC1 template, request an Administrator certificate with the correct object SID, recover the NTLM hash through PKINIT UnPAC the hash, and pass the hash with smbexec to read root.txt.
Aug 9, 2026